The Largest Crypto Heist in History Could Have Been Avoided - CSIS | Center for Strategic and International Studies
On October 29, 2026, hackers drained more than $6 billion from the world’s largest crypto exchange, Binance, in a 20-minute operation.
The heist represents the largest crypto theft in history and underscores the North Korean regime's ability to profit directly from U.S. dollars.
Binance managed to freeze about 44 percent of the stolen funds, but the remaining bitcoin and ether are effectively impossible to recover.
The attack was carried out by the North Korean hacking group 'TraderTraitor', which also orchestrated a $1.5 billion heist against the exchange Bybit in February 2025.
How the Attack Took Place
The operation was a monthslong effort that combined sophisticated social engineering with technical expertise.
Hackers targeted a Binance employee through LinkedIn, orchestrating fake interviews that led the employee to download a malicious assignment.
A separate employee was tricked by a targeted ad campaign into downloading malicious software.
we should have invested more in security earlier and set stricter standards
Once inside the system, the attackers moved quickly to access wallets and transfer funds, obliterating evidence as they operated.
The majority of the cryptocurrency left Binance wallets within about 20 minutes, likely using scripted software rather than AI agents.
The operation is a hallmark of sophisticated state cyber actors, featuring deep preparation, persistent access, and extreme speed.
Funding the North Korean Regime
North Korea has cultivated a cyber ecosystem to support its strategic objectives, including regime survival and defense capabilities.
Cryptocurrency heists are a highly lucrative tool for the regime to evade sanctions and fund its defense program.
Since 2017, North Korean hackers have stolen approximately $12.8 billion in cryptocurrencies, with $7.8 billion taken in 2026 alone.
A UN panel of experts found that up to 40 percent of North Korea's defense budget was funded through stolen cryptocurrencies.
The funds from the Binance hack were laundered across 12,000 wallets, 11 blockchains, and over 40,000 transactions.
The laundered funds were sent to Chinese banks, which have no obligation to provide real names, effectively anonymizing the transactions.
A Lax Security Environment
The Trump administration's pro-innovation agenda has made it reluctant to regulate cryptocurrency companies, contributing to a lax security environment.
President Trump pardoned Binance cofounder Changpeng Zhao in October 2025, effectively paving the way for U.S. citizens to trade on the platform.
Yi He acknowledged that throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases.
The administration's August 2026 presidential memo authorizes offensive cyber operations by the private sector but forbids targeting state-affiliated actors.
This restriction collides with the realities of the cyber threat landscape, as North Korea relies upon state-sponsored cybercriminals for financial gain.
A Tipping Point?
The scale and speed of the Binance attack point to a moment of complacency in the AI-enabled era.
Governments across the world are distracted by elections, conflicts, and domestic unrest, while the private sector continues to fail at cybersecurity.
The incident, alongside other major cyberattacks in Europe and the U.S., demonstrates a palpable increase in collective risk appetites.
If a $6 billion loss is not enough to prompt change, the question remains: what is the tipping point for global cybersecurity?
Related
